{"action":"Upgrade winter/wn-backend-module to 1.2.13 or later.","affected":[{"fixed":"1.2.13","introduced":"1.2.10"}],"component":"winter/wn-backend-module","cve_ids":["CVE-2026-32258"],"ecosystem":"Packagist","epss":0.00382,"exploited":false,"fixed_versions":["1.2.13"],"ghsa_id":"GHSA-vgp4-2fc4-qff2","id":"tcs_01M5KF95W13Q3JS319DTEVKDKP","modified_at":"2026-08-12T14:56:06.645322Z","published_at":"2026-08-12T14:40:38Z","references":["https://osv.dev/vulnerability/GHSA-vgp4-2fc4-qff2","https://github.com/wintercms/winter/security/advisories/GHSA-vgp4-2fc4-qff2","https://github.com/wintercms/winter/commit/d28f0b9474af79cfaa80eeb9d691f7a7c4469720","https://github.com/wintercms/winter"],"severity":{"label":"high","score":8.1},"sources":[{"source":"osv","source_id":"GHSA-vgp4-2fc4-qff2","url":"https://osv.dev/vulnerability/GHSA-vgp4-2fc4-qff2"}],"summary":"Winter: Stored XSS through Editor Settings custom styles"}